To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1293
- compare with another revision
- download diff
- download tarball
- view history from revision 1293
- Committer: Teddy Hogeborn
- Date: 2024-09-08 17:40:26 UTC
- Revision ID: teddy@recompile.se-20240908174026-yk98lyrpr0phsck1
Fix minor deprecated syntax issue in debian/control
The << syntax should be preferred to the deprecated < notation.
* debian/control (Source: mandos/Build-Depends): Change from having
"systemd (< 256~rc2-1)" to "systemd (<< 256~rc2-1)".
The << syntax should be preferred to the deprecated < notation.
* debian/control (Source: mandos/Build-Depends): Change from having
"systemd (< 256~rc2-1)" to "systemd (<< 256~rc2-1)".
- files added:
- debian/mandos.maintscript
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
34
35
34
from __future__ import (division, absolute_import, print_function,
36
35
unicode_literals)
37
36
40
39
except ImportError:
41
40
pass
42
41
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
43
47
try:
44
48
import SocketServer as socketserver
45
49
except ImportError:
46
50
import socketserver
47
51
import socket
48
import argparse
49
52
import datetime
50
53
import errno
51
54
try:
52
55
import ConfigParser as configparser
53
56
except ImportError:
54
57
import configparser
55
import sys
56
58
import re
57
import os
58
59
import signal
59
60
import subprocess
60
61
import atexit
61
62
import stat
62
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
80
import unittest
80
import random
81
import shlex
81
82
82
83
import dbus
83
84
import dbus.service
91
92
92
93
if sys.version_info.major == 2:
93
94
__metaclass__ = type
95
str = unicode
96
input = raw_input
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
94
112
95
113
# Show warnings by default
96
114
if not sys.warnoptions:
122
140
# No value found
123
141
SO_BINDTODEVICE = None
124
142
125
if sys.version_info.major == 2:
126
str = unicode
127
128
143
if sys.version_info < (3, 2):
129
144
configparser.Configparser = configparser.SafeConfigParser
130
145
131
version = "1.8.8"
146
version = "1.8.16"
132
147
stored_state_file = "clients.pickle"
133
148
134
logger = logging.getLogger()
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
135
150
logging.captureWarnings(True) # Show warnings via the logging system
136
151
syslogger = None
137
152
174
189
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
175
190
address="/dev/log"))
176
191
syslogger.setFormatter(logging.Formatter
177
('Mandos [%(process)d]: %(levelname)s:'
178
' %(message)s'))
179
logger.addHandler(syslogger)
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
194
log.addHandler(syslogger)
180
195
181
196
if debug:
182
197
console = logging.StreamHandler()
183
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
184
' [%(process)d]:'
185
' %(levelname)s:'
186
' %(message)s'))
187
logger.addHandler(console)
188
logger.setLevel(level)
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
202
log.addHandler(console)
203
log.setLevel(level)
189
204
190
205
191
206
class PGPError(Exception):
203
218
output = subprocess.check_output(["gpgconf"])
204
219
for line in output.splitlines():
205
220
name, text, path = line.split(b":")
206
if name == "gpg":
221
if name == b"gpg":
207
222
self.gpg = path
208
223
break
209
224
except OSError as e:
210
225
if e.errno != errno.ENOENT:
211
226
raise
212
self.gnupgargs = ['--batch',
213
'--homedir', self.tempdir,
214
'--force-mdc',
215
'--quiet']
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
216
231
# Only GPG version 1 has the --no-use-agent option.
217
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
218
233
self.gnupgargs.append("--no-use-agent")
219
234
220
235
def __enter__(self):
257
272
dir=self.tempdir) as passfile:
258
273
passfile.write(passphrase)
259
274
passfile.flush()
260
proc = subprocess.Popen([self.gpg, '--symmetric',
261
'--passphrase-file',
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
262
277
passfile.name]
263
278
+ self.gnupgargs,
264
279
stdin=subprocess.PIPE,
275
290
dir=self.tempdir) as passfile:
276
291
passfile.write(passphrase)
277
292
passfile.flush()
278
proc = subprocess.Popen([self.gpg, '--decrypt',
279
'--passphrase-file',
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
280
295
passfile.name]
281
296
+ self.gnupgargs,
282
297
stdin=subprocess.PIPE,
335
350
Attributes:
336
351
interface: integer; avahi.IF_UNSPEC or an interface index.
337
352
Used to optionally bind to the specified interface.
338
name: string; Example: 'Mandos'
339
type: string; Example: '_mandos._tcp'.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
340
355
See <https://www.iana.org/assignments/service-names-port-numbers>
341
356
port: integer; what port to announce
342
357
TXT: list of strings; TXT record for the service
379
394
def rename(self, remove=True):
380
395
"""Derived from the Avahi example code"""
381
396
if self.rename_count >= self.max_renames:
382
logger.critical("No suitable Zeroconf service name found"
383
" after %i retries, exiting.",
384
self.rename_count)
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
385
400
raise AvahiServiceError("Too many renames")
386
401
self.name = str(
387
402
self.server.GetAlternativeServiceName(self.name))
388
403
self.rename_count += 1
389
logger.info("Changing Zeroconf service name to %r ...",
390
self.name)
404
log.info("Changing Zeroconf service name to %r ...",
405
self.name)
391
406
if remove:
392
407
self.remove()
393
408
try:
395
410
except dbus.exceptions.DBusException as error:
396
411
if (error.get_dbus_name()
397
412
== "org.freedesktop.Avahi.CollisionError"):
398
logger.info("Local Zeroconf service name collision.")
413
log.info("Local Zeroconf service name collision.")
399
414
return self.rename(remove=False)
400
415
else:
401
logger.critical("D-Bus Exception", exc_info=error)
416
log.critical("D-Bus Exception", exc_info=error)
402
417
self.cleanup()
403
418
os._exit(1)
404
419
420
435
avahi.DBUS_INTERFACE_ENTRY_GROUP)
421
436
self.entry_group_state_changed_match = (
422
437
self.group.connect_to_signal(
423
'StateChanged', self.entry_group_state_changed))
424
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
425
self.name, self.type)
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
426
441
self.group.AddService(
427
442
self.interface,
428
443
self.protocol,
435
450
436
451
def entry_group_state_changed(self, state, error):
437
452
"""Derived from the Avahi example code"""
438
logger.debug("Avahi entry group state change: %i", state)
453
log.debug("Avahi entry group state change: %i", state)
439
454
440
455
if state == avahi.ENTRY_GROUP_ESTABLISHED:
441
logger.debug("Zeroconf service established.")
456
log.debug("Zeroconf service established.")
442
457
elif state == avahi.ENTRY_GROUP_COLLISION:
443
logger.info("Zeroconf service name collision.")
458
log.info("Zeroconf service name collision.")
444
459
self.rename()
445
460
elif state == avahi.ENTRY_GROUP_FAILURE:
446
logger.critical("Avahi: Error in group state changed %s",
447
str(error))
461
log.critical("Avahi: Error in group state changed %s",
462
str(error))
448
463
raise AvahiGroupError("State changed: {!s}".format(error))
449
464
450
465
def cleanup(self):
460
475
461
476
def server_state_changed(self, state, error=None):
462
477
"""Derived from the Avahi example code"""
463
logger.debug("Avahi server state change: %i", state)
478
log.debug("Avahi server state change: %i", state)
464
479
bad_states = {
465
480
avahi.SERVER_INVALID: "Zeroconf server invalid",
466
481
avahi.SERVER_REGISTERING: None,
470
485
if state in bad_states:
471
486
if bad_states[state] is not None:
472
487
if error is None:
473
logger.error(bad_states[state])
488
log.error(bad_states[state])
474
489
else:
475
logger.error(bad_states[state] + ": %r", error)
490
log.error(bad_states[state] + ": %r", error)
476
491
self.cleanup()
477
492
elif state == avahi.SERVER_RUNNING:
478
493
try:
480
495
except dbus.exceptions.DBusException as error:
481
496
if (error.get_dbus_name()
482
497
== "org.freedesktop.Avahi.CollisionError"):
483
logger.info("Local Zeroconf service name"
484
" collision.")
498
log.info("Local Zeroconf service name collision.")
485
499
return self.rename(remove=False)
486
500
else:
487
logger.critical("D-Bus Exception", exc_info=error)
501
log.critical("D-Bus Exception", exc_info=error)
488
502
self.cleanup()
489
503
os._exit(1)
490
504
else:
491
505
if error is None:
492
logger.debug("Unknown state: %r", state)
506
log.debug("Unknown state: %r", state)
493
507
else:
494
logger.debug("Unknown state: %r: %r", state, error)
508
log.debug("Unknown state: %r: %r", state, error)
495
509
496
510
def activate(self):
497
511
"""Derived from the Avahi example code"""
509
523
class AvahiServiceToSyslog(AvahiService):
510
524
def rename(self, *args, **kwargs):
511
525
"""Add the new name to the syslog messages"""
512
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
527
**kwargs)
513
528
syslogger.setFormatter(logging.Formatter(
514
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
515
530
.format(self.name)))
516
531
return ret
517
532
547
562
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
548
563
549
564
# Types
550
class session_int(ctypes.Structure):
565
class _session_int(ctypes.Structure):
551
566
_fields_ = []
552
session_t = ctypes.POINTER(session_int)
567
session_t = ctypes.POINTER(_session_int)
553
568
554
569
class certificate_credentials_st(ctypes.Structure):
555
570
_fields_ = []
558
573
certificate_type_t = ctypes.c_int
559
574
560
575
class datum_t(ctypes.Structure):
561
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
562
('size', ctypes.c_uint)]
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
563
578
564
class openpgp_crt_int(ctypes.Structure):
579
class _openpgp_crt_int(ctypes.Structure):
565
580
_fields_ = []
566
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
567
582
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
568
583
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
569
584
credentials_type_t = ctypes.c_int
578
593
# gnutls.strerror()
579
594
self.code = code
580
595
if message is None and code is not None:
581
message = gnutls.strerror(code)
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
582
598
return super(gnutls.Error, self).__init__(
583
599
message, *args)
584
600
585
601
class CertificateSecurityError(Error):
586
602
pass
587
603
604
class PointerTo:
605
def __init__(self, cls):
606
self.cls = cls
607
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
613
614
class CastToVoidPointer:
615
def __init__(self, cls):
616
self.cls = cls
617
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
class With_from_param:
625
@classmethod
626
def from_param(cls, obj):
627
return obj._as_parameter_
628
588
629
# Classes
589
class Credentials:
630
class Credentials(With_from_param):
590
631
def __init__(self):
591
self._c_object = gnutls.certificate_credentials_t()
592
gnutls.certificate_allocate_credentials(
593
ctypes.byref(self._c_object))
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
594
634
self.type = gnutls.CRD_CERTIFICATE
595
635
596
636
def __del__(self):
597
gnutls.certificate_free_credentials(self._c_object)
637
gnutls.certificate_free_credentials(self)
598
638
599
class ClientSession:
639
class ClientSession(With_from_param):
600
640
def __init__(self, socket, credentials=None):
601
self._c_object = gnutls.session_t()
641
self._as_parameter_ = gnutls.session_t()
602
642
gnutls_flags = gnutls.CLIENT
603
643
if gnutls.check_version(b"3.5.6"):
604
644
gnutls_flags |= gnutls.NO_TICKETS
605
645
if gnutls.has_rawpk:
606
646
gnutls_flags |= gnutls.ENABLE_RAWPK
607
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
647
gnutls.init(self, gnutls_flags)
608
648
del gnutls_flags
609
gnutls.set_default_priority(self._c_object)
610
gnutls.transport_set_ptr(self._c_object, socket.fileno())
611
gnutls.handshake_set_private_extensions(self._c_object,
612
True)
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
613
652
self.socket = socket
614
653
if credentials is None:
615
654
credentials = gnutls.Credentials()
616
gnutls.credentials_set(self._c_object, credentials.type,
617
ctypes.cast(credentials._c_object,
618
ctypes.c_void_p))
655
gnutls.credentials_set(self, credentials.type,
656
credentials)
619
657
self.credentials = credentials
620
658
621
659
def __del__(self):
622
gnutls.deinit(self._c_object)
660
gnutls.deinit(self)
623
661
624
662
def handshake(self):
625
return gnutls.handshake(self._c_object)
663
return gnutls.handshake(self)
626
664
627
665
def send(self, data):
628
666
data = bytes(data)
629
667
data_len = len(data)
630
668
while data_len > 0:
631
data_len -= gnutls.record_send(self._c_object,
632
data[-data_len:],
669
data_len -= gnutls.record_send(self, data[-data_len:],
633
670
data_len)
634
671
635
672
def bye(self):
636
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
637
674
638
675
# Error handling functions
639
676
def _error_code(result):
640
677
"""A function to raise exceptions on errors, suitable
641
for the 'restype' attribute on ctypes functions"""
642
if result >= 0:
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
643
680
return result
644
681
if result == gnutls.E_NO_CERTIFICATE_FOUND:
645
682
raise gnutls.CertificateSecurityError(code=result)
646
683
raise gnutls.Error(code=result)
647
684
648
def _retry_on_error(result, func, arguments):
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
649
687
"""A function to retry on some errors, suitable
650
for the 'errcheck' attribute on ctypes functions"""
651
while result < 0:
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
652
690
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
653
691
return _error_code(result)
654
692
result = func(*arguments)
659
697
660
698
# Functions
661
699
priority_set_direct = _library.gnutls_priority_set_direct
662
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
663
701
ctypes.POINTER(ctypes.c_char_p)]
664
702
priority_set_direct.restype = _error_code
665
703
666
704
init = _library.gnutls_init
667
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
668
706
init.restype = _error_code
669
707
670
708
set_default_priority = _library.gnutls_set_default_priority
671
set_default_priority.argtypes = [session_t]
709
set_default_priority.argtypes = [ClientSession]
672
710
set_default_priority.restype = _error_code
673
711
674
712
record_send = _library.gnutls_record_send
675
record_send.argtypes = [session_t, ctypes.c_void_p,
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
676
714
ctypes.c_size_t]
677
715
record_send.restype = ctypes.c_ssize_t
678
716
record_send.errcheck = _retry_on_error
680
718
certificate_allocate_credentials = (
681
719
_library.gnutls_certificate_allocate_credentials)
682
720
certificate_allocate_credentials.argtypes = [
683
ctypes.POINTER(certificate_credentials_t)]
721
PointerTo(Credentials)]
684
722
certificate_allocate_credentials.restype = _error_code
685
723
686
724
certificate_free_credentials = (
687
725
_library.gnutls_certificate_free_credentials)
688
certificate_free_credentials.argtypes = [
689
certificate_credentials_t]
726
certificate_free_credentials.argtypes = [Credentials]
690
727
certificate_free_credentials.restype = None
691
728
692
729
handshake_set_private_extensions = (
693
730
_library.gnutls_handshake_set_private_extensions)
694
handshake_set_private_extensions.argtypes = [session_t,
731
handshake_set_private_extensions.argtypes = [ClientSession,
695
732
ctypes.c_int]
696
733
handshake_set_private_extensions.restype = None
697
734
698
735
credentials_set = _library.gnutls_credentials_set
699
credentials_set.argtypes = [session_t, credentials_type_t,
700
ctypes.c_void_p]
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
701
738
credentials_set.restype = _error_code
702
739
703
740
strerror = _library.gnutls_strerror
705
742
strerror.restype = ctypes.c_char_p
706
743
707
744
certificate_type_get = _library.gnutls_certificate_type_get
708
certificate_type_get.argtypes = [session_t]
745
certificate_type_get.argtypes = [ClientSession]
709
746
certificate_type_get.restype = _error_code
710
747
711
748
certificate_get_peers = _library.gnutls_certificate_get_peers
712
certificate_get_peers.argtypes = [session_t,
749
certificate_get_peers.argtypes = [ClientSession,
713
750
ctypes.POINTER(ctypes.c_uint)]
714
751
certificate_get_peers.restype = ctypes.POINTER(datum_t)
715
752
722
759
global_set_log_function.restype = None
723
760
724
761
deinit = _library.gnutls_deinit
725
deinit.argtypes = [session_t]
762
deinit.argtypes = [ClientSession]
726
763
deinit.restype = None
727
764
728
765
handshake = _library.gnutls_handshake
729
handshake.argtypes = [session_t]
730
handshake.restype = _error_code
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
731
768
handshake.errcheck = _retry_on_error
732
769
733
770
transport_set_ptr = _library.gnutls_transport_set_ptr
734
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
735
772
transport_set_ptr.restype = None
736
773
737
774
bye = _library.gnutls_bye
738
bye.argtypes = [session_t, close_request_t]
739
bye.restype = _error_code
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
740
777
bye.errcheck = _retry_on_error
741
778
742
779
check_version = _library.gnutls_check_version
759
796
760
797
x509_crt_fmt_t = ctypes.c_int
761
798
762
# All the function declarations below are from gnutls/abstract.h
799
# All the function declarations below are from
800
# gnutls/abstract.h
763
801
pubkey_init = _library.gnutls_pubkey_init
764
802
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
765
803
pubkey_init.restype = _error_code
779
817
pubkey_deinit.argtypes = [pubkey_t]
780
818
pubkey_deinit.restype = None
781
819
else:
782
# All the function declarations below are from gnutls/openpgp.h
820
# All the function declarations below are from
821
# gnutls/openpgp.h
783
822
784
823
openpgp_crt_init = _library.gnutls_openpgp_crt_init
785
824
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
791
830
openpgp_crt_fmt_t]
792
831
openpgp_crt_import.restype = _error_code
793
832
794
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
795
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
796
ctypes.POINTER(ctypes.c_uint)]
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
836
openpgp_crt_t,
837
ctypes.c_uint,
838
ctypes.POINTER(ctypes.c_uint),
839
]
797
840
openpgp_crt_verify_self.restype = _error_code
798
841
799
842
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
810
853
811
854
if check_version(b"3.6.4"):
812
855
certificate_type_get2 = _library.gnutls_certificate_type_get2
813
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
814
857
certificate_type_get2.restype = _error_code
815
858
816
859
# Remove non-public functions
832
875
"""A representation of a client host served by this server.
833
876
834
877
Attributes:
835
approved: bool(); 'None' if not yet approved/disapproved
878
approved: bool(); None if not yet approved/disapproved
836
879
approval_delay: datetime.timedelta(); Time to wait for approval
837
880
approval_duration: datetime.timedelta(); Duration of one approval
838
881
checker: multiprocessing.Process(); a running checker process used
839
to see if the client lives. 'None' if no process is
882
to see if the client lives. None if no process is
840
883
running.
841
884
checker_callback_tag: a GLib event source tag, or None
842
885
checker_command: string; External command which is run to check
918
961
# key_id() and fingerprint() functions
919
962
client["key_id"] = (section.get("key_id", "").upper()
920
963
.replace(" ", ""))
921
client["fingerprint"] = (section["fingerprint"].upper()
964
client["fingerprint"] = (section.get("fingerprint",
965
"").upper()
922
966
.replace(" ", ""))
967
if not (client["key_id"] or client["fingerprint"]):
968
log.error("Skipping client %s without key_id or"
969
" fingerprint", client_name)
970
del settings[client_name]
971
continue
923
972
if "secret" in section:
924
973
client["secret"] = codecs.decode(section["secret"]
925
974
.encode("utf-8"),
966
1015
self.last_enabled = None
967
1016
self.expires = None
968
1017
969
logger.debug("Creating client %r", self.name)
970
logger.debug(" Key ID: %s", self.key_id)
971
logger.debug(" Fingerprint: %s", self.fingerprint)
1018
log.debug("Creating client %r", self.name)
1019
log.debug(" Key ID: %s", self.key_id)
1020
log.debug(" Fingerprint: %s", self.fingerprint)
972
1021
self.created = settings.get("created",
973
1022
datetime.datetime.utcnow())
974
1023
1002
1051
if getattr(self, "enabled", False):
1003
1052
# Already enabled
1004
1053
return
1005
self.expires = datetime.datetime.utcnow() + self.timeout
1006
1054
self.enabled = True
1007
1055
self.last_enabled = datetime.datetime.utcnow()
1008
1056
self.init_checker()
1013
1061
if not getattr(self, "enabled", False):
1014
1062
return False
1015
1063
if not quiet:
1016
logger.info("Disabling client %s", self.name)
1064
log.info("Disabling client %s", self.name)
1017
1065
if getattr(self, "disable_initiator_tag", None) is not None:
1018
1066
GLib.source_remove(self.disable_initiator_tag)
1019
1067
self.disable_initiator_tag = None
1031
1079
def __del__(self):
1032
1080
self.disable()
1033
1081
1034
def init_checker(self):
1035
# Schedule a new checker to be started an 'interval' from now,
1036
# and every interval from then on.
1082
def init_checker(self, randomize_start=False):
1083
# Schedule a new checker to be started a randomly selected
1084
# time (a fraction of 'interval') from now. This spreads out
1085
# the startup of checkers over time when the server is
1086
# started.
1037
1087
if self.checker_initiator_tag is not None:
1038
1088
GLib.source_remove(self.checker_initiator_tag)
1089
interval_milliseconds = int(self.interval.total_seconds()
1090
* 1000)
1091
if randomize_start:
1092
delay_milliseconds = random.randrange(
1093
interval_milliseconds + 1)
1094
else:
1095
delay_milliseconds = interval_milliseconds
1039
1096
self.checker_initiator_tag = GLib.timeout_add(
1040
int(self.interval.total_seconds() * 1000),
1041
self.start_checker)
1042
# Schedule a disable() when 'timeout' has passed
1097
delay_milliseconds, self.start_checker, randomize_start)
1098
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1099
# A checker might take up to an 'interval' of time, so we can
1100
# expire at the soonest one interval after a checker was
1101
# started. Since the initial checker is delayed, the expire
1102
# time might have to be extended.
1103
now = datetime.datetime.utcnow()
1104
self.expires = now + delay + self.interval
1105
# Schedule a disable() at expire time
1043
1106
if self.disable_initiator_tag is not None:
1044
1107
GLib.source_remove(self.disable_initiator_tag)
1045
1108
self.disable_initiator_tag = GLib.timeout_add(
1046
int(self.timeout.total_seconds() * 1000), self.disable)
1047
# Also start a new checker *right now*.
1048
self.start_checker()
1109
int((self.expires - now).total_seconds() * 1000),
1110
self.disable)
1049
1111
1050
1112
def checker_callback(self, source, condition, connection,
1051
1113
command):
1053
1115
# Read return code from connection (see call_pipe)
1054
1116
returncode = connection.recv()
1055
1117
connection.close()
1056
self.checker.join()
1118
if self.checker is not None:
1119
self.checker.join()
1057
1120
self.checker_callback_tag = None
1058
1121
self.checker = None
1059
1122
1061
1124
self.last_checker_status = returncode
1062
1125
self.last_checker_signal = None
1063
1126
if self.last_checker_status == 0:
1064
logger.info("Checker for %(name)s succeeded",
1065
vars(self))
1127
log.info("Checker for %(name)s succeeded", vars(self))
1066
1128
self.checked_ok()
1067
1129
else:
1068
logger.info("Checker for %(name)s failed", vars(self))
1130
log.info("Checker for %(name)s failed", vars(self))
1069
1131
else:
1070
1132
self.last_checker_status = -1
1071
1133
self.last_checker_signal = -returncode
1072
logger.warning("Checker for %(name)s crashed?",
1073
vars(self))
1134
log.warning("Checker for %(name)s crashed?", vars(self))
1074
1135
return False
1075
1136
1076
1137
def checked_ok(self):
1095
1156
def need_approval(self):
1096
1157
self.last_approval_request = datetime.datetime.utcnow()
1097
1158
1098
def start_checker(self):
1159
def start_checker(self, start_was_randomized=False):
1099
1160
"""Start a new checker subprocess if one is not running.
1100
1161
1101
1162
If a checker already exists, leave it running and do
1110
1171
# should be.
1111
1172
1112
1173
if self.checker is not None and not self.checker.is_alive():
1113
logger.warning("Checker was not alive; joining")
1174
log.warning("Checker was not alive; joining")
1114
1175
self.checker.join()
1115
1176
self.checker = None
1116
1177
# Start a new checker if needed
1117
1178
if self.checker is None:
1118
1179
# Escape attributes for the shell
1119
1180
escaped_attrs = {
1120
attr: re.escape(str(getattr(self, attr)))
1181
attr: shlex.quote(str(getattr(self, attr)))
1121
1182
for attr in self.runtime_expansions}
1122
1183
try:
1123
1184
command = self.checker_command % escaped_attrs
1124
1185
except TypeError as error:
1125
logger.error('Could not format string "%s"',
1126
self.checker_command,
1127
exc_info=error)
1186
log.error('Could not format string "%s"',
1187
self.checker_command, exc_info=error)
1128
1188
return True # Try again later
1129
1189
self.current_checker_command = command
1130
logger.info("Starting checker %r for %s", command,
1131
self.name)
1190
log.info("Starting checker %r for %s", command, self.name)
1132
1191
# We don't need to redirect stdout and stderr, since
1133
1192
# in normal mode, that is already done by daemon(),
1134
1193
# and in debug mode we don't want to. (Stdin is
1153
1212
GLib.IOChannel.unix_new(pipe[0].fileno()),
1154
1213
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1155
1214
self.checker_callback, pipe[0], command)
1215
if start_was_randomized:
1216
# We were started after a random delay; Schedule a new
1217
# checker to be started an 'interval' from now, and every
1218
# interval from then on.
1219
now = datetime.datetime.utcnow()
1220
self.checker_initiator_tag = GLib.timeout_add(
1221
int(self.interval.total_seconds() * 1000),
1222
self.start_checker)
1223
self.expires = max(self.expires, now + self.interval)
1224
# Don't start a new checker again after same random delay
1225
return False
1156
1226
# Re-run this periodically if run by GLib.timeout_add
1157
1227
return True
1158
1228
1163
1233
self.checker_callback_tag = None
1164
1234
if getattr(self, "checker", None) is None:
1165
1235
return
1166
logger.debug("Stopping checker for %(name)s", vars(self))
1236
log.debug("Stopping checker for %(name)s", vars(self))
1167
1237
self.checker.terminate()
1168
1238
self.checker = None
1169
1239
1196
1266
func._dbus_name = func.__name__
1197
1267
if func._dbus_name.endswith("_dbus_property"):
1198
1268
func._dbus_name = func._dbus_name[:-14]
1199
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1269
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1200
1270
return func
1201
1271
1202
1272
return decorator
1291
1361
1292
1362
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1293
1363
out_signature="s",
1294
path_keyword='object_path',
1295
connection_keyword='connection')
1364
path_keyword="object_path",
1365
connection_keyword="connection")
1296
1366
def Introspect(self, object_path, connection):
1297
1367
"""Overloading of standard D-Bus method.
1298
1368
1347
1417
document.unlink()
1348
1418
except (AttributeError, xml.dom.DOMException,
1349
1419
xml.parsers.expat.ExpatError) as error:
1350
logger.error("Failed to override Introspection method",
1351
exc_info=error)
1420
log.error("Failed to override Introspection method",
1421
exc_info=error)
1352
1422
return xmlstring
1353
1423
1354
1424
1412
1482
raise ValueError("Byte arrays not supported for non-"
1413
1483
"'ay' signature {!r}"
1414
1484
.format(prop._dbus_signature))
1415
value = dbus.ByteArray(b''.join(chr(byte)
1416
for byte in value))
1485
value = dbus.ByteArray(bytes(value))
1417
1486
prop(value)
1418
1487
1419
1488
@dbus.service.method(dbus.PROPERTIES_IFACE,
1452
1521
1453
1522
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1454
1523
out_signature="s",
1455
path_keyword='object_path',
1456
connection_keyword='connection')
1524
path_keyword="object_path",
1525
connection_keyword="connection")
1457
1526
def Introspect(self, object_path, connection):
1458
1527
"""Overloading of standard D-Bus method.
1459
1528
1515
1584
document.unlink()
1516
1585
except (AttributeError, xml.dom.DOMException,
1517
1586
xml.parsers.expat.ExpatError) as error:
1518
logger.error("Failed to override Introspection method",
1519
exc_info=error)
1587
log.error("Failed to override Introspection method",
1588
exc_info=error)
1520
1589
return xmlstring
1521
1590
1522
1591
1554
1623
1555
1624
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1556
1625
out_signature="s",
1557
path_keyword='object_path',
1558
connection_keyword='connection')
1626
path_keyword="object_path",
1627
connection_keyword="connection")
1559
1628
def Introspect(self, object_path, connection):
1560
1629
"""Overloading of standard D-Bus method.
1561
1630
1586
1655
document.unlink()
1587
1656
except (AttributeError, xml.dom.DOMException,
1588
1657
xml.parsers.expat.ExpatError) as error:
1589
logger.error("Failed to override Introspection method",
1590
exc_info=error)
1658
log.error("Failed to override Introspection method",
1659
exc_info=error)
1591
1660
return xmlstring
1592
1661
1593
1662
2227
2296
class ProxyClient:
2228
2297
def __init__(self, child_pipe, key_id, fpr, address):
2229
2298
self._pipe = child_pipe
2230
self._pipe.send(('init', key_id, fpr, address))
2299
self._pipe.send(("init", key_id, fpr, address))
2231
2300
if not self._pipe.recv():
2232
2301
raise KeyError(key_id or fpr)
2233
2302
2234
2303
def __getattribute__(self, name):
2235
if name == '_pipe':
2304
if name == "_pipe":
2236
2305
return super(ProxyClient, self).__getattribute__(name)
2237
self._pipe.send(('getattr', name))
2306
self._pipe.send(("getattr", name))
2238
2307
data = self._pipe.recv()
2239
if data[0] == 'data':
2308
if data[0] == "data":
2240
2309
return data[1]
2241
if data[0] == 'function':
2310
if data[0] == "function":
2242
2311
2243
2312
def func(*args, **kwargs):
2244
self._pipe.send(('funcall', name, args, kwargs))
2313
self._pipe.send(("funcall", name, args, kwargs))
2245
2314
return self._pipe.recv()[1]
2246
2315
2247
2316
return func
2248
2317
2249
2318
def __setattr__(self, name, value):
2250
if name == '_pipe':
2319
if name == "_pipe":
2251
2320
return super(ProxyClient, self).__setattr__(name, value)
2252
self._pipe.send(('setattr', name, value))
2321
self._pipe.send(("setattr", name, value))
2253
2322
2254
2323
2255
2324
class ClientHandler(socketserver.BaseRequestHandler, object):
2260
2329
2261
2330
def handle(self):
2262
2331
with contextlib.closing(self.server.child_pipe) as child_pipe:
2263
logger.info("TCP connection from: %s",
2264
str(self.client_address))
2265
logger.debug("Pipe FD: %d",
2266
self.server.child_pipe.fileno())
2332
log.info("TCP connection from: %s",
2333
str(self.client_address))
2334
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2267
2335
2268
2336
session = gnutls.ClientSession(self.request)
2269
2337
2270
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2338
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2271
2339
# "+AES-256-CBC", "+SHA1",
2272
2340
# "+COMP-NULL", "+CTYPE-OPENPGP",
2273
2341
# "+DHE-DSS"))
2275
2343
priority = self.server.gnutls_priority
2276
2344
if priority is None:
2277
2345
priority = "NORMAL"
2278
gnutls.priority_set_direct(session._c_object,
2279
priority.encode("utf-8"),
2280
None)
2346
gnutls.priority_set_direct(session,
2347
priority.encode("utf-8"), None)
2281
2348
2282
2349
# Start communication using the Mandos protocol
2283
2350
# Get protocol number
2284
2351
line = self.request.makefile().readline()
2285
logger.debug("Protocol version: %r", line)
2352
log.debug("Protocol version: %r", line)
2286
2353
try:
2287
2354
if int(line.strip().split()[0]) > 1:
2288
2355
raise RuntimeError(line)
2289
2356
except (ValueError, IndexError, RuntimeError) as error:
2290
logger.error("Unknown protocol version: %s", error)
2357
log.error("Unknown protocol version: %s", error)
2291
2358
return
2292
2359
2293
2360
# Start GnuTLS connection
2294
2361
try:
2295
2362
session.handshake()
2296
2363
except gnutls.Error as error:
2297
logger.warning("Handshake failed: %s", error)
2364
log.warning("Handshake failed: %s", error)
2298
2365
# Do not run session.bye() here: the session is not
2299
2366
# established. Just abandon the request.
2300
2367
return
2301
logger.debug("Handshake succeeded")
2368
log.debug("Handshake succeeded")
2302
2369
2303
2370
approval_required = False
2304
2371
try:
2308
2375
key_id = self.key_id(
2309
2376
self.peer_certificate(session))
2310
2377
except (TypeError, gnutls.Error) as error:
2311
logger.warning("Bad certificate: %s", error)
2378
log.warning("Bad certificate: %s", error)
2312
2379
return
2313
logger.debug("Key ID: %s", key_id)
2380
log.debug("Key ID: %s",
2381
key_id.decode("utf-8",
2382
errors="replace"))
2314
2383
2315
2384
else:
2316
2385
key_id = b""
2318
2387
fpr = self.fingerprint(
2319
2388
self.peer_certificate(session))
2320
2389
except (TypeError, gnutls.Error) as error:
2321
logger.warning("Bad certificate: %s", error)
2390
log.warning("Bad certificate: %s", error)
2322
2391
return
2323
logger.debug("Fingerprint: %s", fpr)
2392
log.debug("Fingerprint: %s", fpr)
2324
2393
2325
2394
try:
2326
2395
client = ProxyClient(child_pipe, key_id, fpr,
2335
2404
2336
2405
while True:
2337
2406
if not client.enabled:
2338
logger.info("Client %s is disabled",
2339
client.name)
2407
log.info("Client %s is disabled", client.name)
2340
2408
if self.server.use_dbus:
2341
2409
# Emit D-Bus signal
2342
2410
client.Rejected("Disabled")
2346
2414
# We are approved or approval is disabled
2347
2415
break
2348
2416
elif client.approved is None:
2349
logger.info("Client %s needs approval",
2350
client.name)
2417
log.info("Client %s needs approval",
2418
client.name)
2351
2419
if self.server.use_dbus:
2352
2420
# Emit D-Bus signal
2353
2421
client.NeedApproval(
2354
2422
client.approval_delay.total_seconds()
2355
2423
* 1000, client.approved_by_default)
2356
2424
else:
2357
logger.warning("Client %s was not approved",
2358
client.name)
2425
log.warning("Client %s was not approved",
2426
client.name)
2359
2427
if self.server.use_dbus:
2360
2428
# Emit D-Bus signal
2361
2429
client.Rejected("Denied")
2369
2437
time2 = datetime.datetime.now()
2370
2438
if (time2 - time) >= delay:
2371
2439
if not client.approved_by_default:
2372
logger.warning("Client %s timed out while"
2373
" waiting for approval",
2374
client.name)
2440
log.warning("Client %s timed out while"
2441
" waiting for approval",
2442
client.name)
2375
2443
if self.server.use_dbus:
2376
2444
# Emit D-Bus signal
2377
2445
client.Rejected("Approval timed out")
2384
2452
try:
2385
2453
session.send(client.secret)
2386
2454
except gnutls.Error as error:
2387
logger.warning("gnutls send failed",
2388
exc_info=error)
2455
log.warning("gnutls send failed", exc_info=error)
2389
2456
return
2390
2457
2391
logger.info("Sending secret to %s", client.name)
2458
log.info("Sending secret to %s", client.name)
2392
2459
# bump the timeout using extended_timeout
2393
2460
client.bump_timeout(client.extended_timeout)
2394
2461
if self.server.use_dbus:
2401
2468
try:
2402
2469
session.bye()
2403
2470
except gnutls.Error as error:
2404
logger.warning("GnuTLS bye failed",
2405
exc_info=error)
2471
log.warning("GnuTLS bye failed", exc_info=error)
2406
2472
2407
2473
@staticmethod
2408
2474
def peer_certificate(session):
2409
2475
"Return the peer's certificate as a bytestring"
2410
2476
try:
2411
cert_type = gnutls.certificate_type_get2(session._c_object,
2412
gnutls.CTYPE_PEERS)
2477
cert_type = gnutls.certificate_type_get2(
2478
session, gnutls.CTYPE_PEERS)
2413
2479
except AttributeError:
2414
cert_type = gnutls.certificate_type_get(session._c_object)
2480
cert_type = gnutls.certificate_type_get(session)
2415
2481
if gnutls.has_rawpk:
2416
2482
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2417
2483
else:
2418
2484
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2419
2485
# If not a valid certificate type...
2420
2486
if cert_type not in valid_cert_types:
2421
logger.info("Cert type %r not in %r", cert_type,
2422
valid_cert_types)
2487
log.info("Cert type %r not in %r", cert_type,
2488
valid_cert_types)
2423
2489
# ...return invalid data
2424
2490
return b""
2425
2491
list_size = ctypes.c_uint(1)
2426
2492
cert_list = (gnutls.certificate_get_peers
2427
(session._c_object, ctypes.byref(list_size)))
2493
(session, ctypes.byref(list_size)))
2428
2494
if not bool(cert_list) and list_size.value != 0:
2429
2495
raise gnutls.Error("error getting peer certificate")
2430
2496
if list_size.value == 0:
2452
2518
buf = ctypes.create_string_buffer(32)
2453
2519
buf_len = ctypes.c_size_t(len(buf))
2454
2520
# Get the key ID from the raw public key into the buffer
2455
gnutls.pubkey_get_key_id(pubkey,
2456
gnutls.KEYID_USE_SHA256,
2457
ctypes.cast(ctypes.byref(buf),
2458
ctypes.POINTER(ctypes.c_ubyte)),
2459
ctypes.byref(buf_len))
2521
gnutls.pubkey_get_key_id(
2522
pubkey,
2523
gnutls.KEYID_USE_SHA256,
2524
ctypes.cast(ctypes.byref(buf),
2525
ctypes.POINTER(ctypes.c_ubyte)),
2526
ctypes.byref(buf_len))
2460
2527
# Deinit the certificate
2461
2528
gnutls.pubkey_deinit(pubkey)
2462
2529
2543
2610
2544
2611
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2545
2612
socketserver.TCPServer):
2546
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2613
"""IPv6-capable TCP server. Accepts None as address and/or port
2547
2614
2548
2615
Attributes:
2549
2616
enabled: Boolean; whether this server is activated yet
2600
2667
if SO_BINDTODEVICE is None:
2601
2668
# Fall back to a hard-coded value which seems to be
2602
2669
# common enough.
2603
logger.warning("SO_BINDTODEVICE not found, trying 25")
2670
log.warning("SO_BINDTODEVICE not found, trying 25")
2604
2671
SO_BINDTODEVICE = 25
2605
2672
try:
2606
2673
self.socket.setsockopt(
2608
2675
(self.interface + "\0").encode("utf-8"))
2609
2676
except socket.error as error:
2610
2677
if error.errno == errno.EPERM:
2611
logger.error("No permission to bind to"
2612
" interface %s", self.interface)
2678
log.error("No permission to bind to interface %s",
2679
self.interface)
2613
2680
elif error.errno == errno.ENOPROTOOPT:
2614
logger.error("SO_BINDTODEVICE not available;"
2615
" cannot bind to interface %s",
2616
self.interface)
2681
log.error("SO_BINDTODEVICE not available; cannot"
2682
" bind to interface %s", self.interface)
2617
2683
elif error.errno == errno.ENODEV:
2618
logger.error("Interface %s does not exist,"
2619
" cannot bind", self.interface)
2684
log.error("Interface %s does not exist, cannot"
2685
" bind", self.interface)
2620
2686
else:
2621
2687
raise
2622
2688
# Only bind(2) the socket if we really need to.
2701
2767
request = parent_pipe.recv()
2702
2768
command = request[0]
2703
2769
2704
if command == 'init':
2770
if command == "init":
2705
2771
key_id = request[1].decode("ascii")
2706
2772
fpr = request[2].decode("ascii")
2707
2773
address = request[3]
2708
2774
2709
2775
for c in self.clients.values():
2710
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2776
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2777
"27AE41E4649B934CA495991B7852B855"):
2711
2778
continue
2712
2779
if key_id and c.key_id == key_id:
2713
2780
client = c
2716
2783
client = c
2717
2784
break
2718
2785
else:
2719
logger.info("Client not found for key ID: %s, address"
2720
": %s", key_id or fpr, address)
2786
log.info("Client not found for key ID: %s, address:"
2787
" %s", key_id or fpr, address)
2721
2788
if self.use_dbus:
2722
2789
# Emit D-Bus signal
2723
2790
mandos_dbus_service.ClientNotFound(key_id or fpr,
2736
2803
# remove the old hook in favor of the new above hook on
2737
2804
# same fileno
2738
2805
return False
2739
if command == 'funcall':
2806
if command == "funcall":
2740
2807
funcname = request[1]
2741
2808
args = request[2]
2742
2809
kwargs = request[3]
2743
2810
2744
parent_pipe.send(('data', getattr(client_object,
2811
parent_pipe.send(("data", getattr(client_object,
2745
2812
funcname)(*args,
2746
2813
**kwargs)))
2747
2814
2748
if command == 'getattr':
2815
if command == "getattr":
2749
2816
attrname = request[1]
2750
2817
if isinstance(client_object.__getattribute__(attrname),
2751
collections.Callable):
2752
parent_pipe.send(('function', ))
2818
collections.abc.Callable):
2819
parent_pipe.send(("function", ))
2753
2820
else:
2754
2821
parent_pipe.send((
2755
'data', client_object.__getattribute__(attrname)))
2822
"data", client_object.__getattribute__(attrname)))
2756
2823
2757
if command == 'setattr':
2824
if command == "setattr":
2758
2825
attrname = request[1]
2759
2826
value = request[2]
2760
2827
setattr(client_object, attrname, value)
2765
2832
def rfc3339_duration_to_delta(duration):
2766
2833
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2767
2834
2768
>>> rfc3339_duration_to_delta("P7D")
2769
datetime.timedelta(7)
2770
>>> rfc3339_duration_to_delta("PT60S")
2771
datetime.timedelta(0, 60)
2772
>>> rfc3339_duration_to_delta("PT60M")
2773
datetime.timedelta(0, 3600)
2774
>>> rfc3339_duration_to_delta("PT24H")
2775
datetime.timedelta(1)
2776
>>> rfc3339_duration_to_delta("P1W")
2777
datetime.timedelta(7)
2778
>>> rfc3339_duration_to_delta("PT5M30S")
2779
datetime.timedelta(0, 330)
2780
>>> rfc3339_duration_to_delta("P1DT3M20S")
2781
datetime.timedelta(1, 200)
2835
>>> timedelta = datetime.timedelta
2836
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2837
True
2838
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2839
True
2840
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2841
True
2842
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2843
True
2844
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2845
True
2846
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2847
True
2848
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2849
True
2850
>>> del timedelta
2782
2851
"""
2783
2852
2784
2853
# Parsing an RFC 3339 duration with regular expressions is not
2864
2933
def string_to_delta(interval):
2865
2934
"""Parse a string and return a datetime.timedelta
2866
2935
2867
>>> string_to_delta('7d')
2868
datetime.timedelta(7)
2869
>>> string_to_delta('60s')
2870
datetime.timedelta(0, 60)
2871
>>> string_to_delta('60m')
2872
datetime.timedelta(0, 3600)
2873
>>> string_to_delta('24h')
2874
datetime.timedelta(1)
2875
>>> string_to_delta('1w')
2876
datetime.timedelta(7)
2877
>>> string_to_delta('5m 30s')
2878
datetime.timedelta(0, 330)
2936
>>> string_to_delta("7d") == datetime.timedelta(7)
2937
True
2938
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2939
True
2940
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2941
True
2942
>>> string_to_delta("24h") == datetime.timedelta(1)
2943
True
2944
>>> string_to_delta("1w") == datetime.timedelta(7)
2945
True
2946
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2947
True
2879
2948
"""
2880
2949
2881
2950
try:
3084
3153
3085
3154
if server_settings["servicename"] != "Mandos":
3086
3155
syslogger.setFormatter(
3087
logging.Formatter('Mandos ({}) [%(process)d]:'
3088
' %(levelname)s: %(message)s'.format(
3156
logging.Formatter("Mandos ({}) [%(process)d]:"
3157
" %(levelname)s: %(message)s".format(
3089
3158
server_settings["servicename"])))
3090
3159
3091
3160
# Parse config file with clients
3115
3184
try:
3116
3185
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3117
3186
except IOError as e:
3118
logger.error("Could not open file %r", pidfilename,
3119
exc_info=e)
3187
log.error("Could not open file %r", pidfilename,
3188
exc_info=e)
3120
3189
3121
3190
for name, group in (("_mandos", "_mandos"),
3122
3191
("mandos", "mandos"),
3133
3202
try:
3134
3203
os.setgid(gid)
3135
3204
os.setuid(uid)
3136
if debug:
3137
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3138
gid))
3205
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3139
3206
except OSError as error:
3140
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3141
.format(uid, gid, os.strerror(error.errno)))
3207
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3208
os.strerror(error.errno))
3142
3209
if error.errno != errno.EPERM:
3143
3210
raise
3144
3211
3151
3218
3152
3219
@gnutls.log_func
3153
3220
def debug_gnutls(level, string):
3154
logger.debug("GnuTLS: %s", string[:-1])
3221
log.debug("GnuTLS: %s",
3222
string[:-1].decode("utf-8", errors="replace"))
3155
3223
3156
3224
gnutls.global_set_log_function(debug_gnutls)
3157
3225
3186
3254
"se.bsnet.fukt.Mandos", bus,
3187
3255
do_not_queue=True)
3188
3256
except dbus.exceptions.DBusException as e:
3189
logger.error("Disabling D-Bus:", exc_info=e)
3257
log.error("Disabling D-Bus:", exc_info=e)
3190
3258
use_dbus = False
3191
3259
server_settings["use_dbus"] = False
3192
3260
tcp_server.use_dbus = False
3251
3319
if isinstance(s, bytes)
3252
3320
else s) for s in
3253
3321
value["client_structure"]]
3254
# .name & .host
3255
for k in ("name", "host"):
3322
# .name, .host, and .checker_command
3323
for k in ("name", "host", "checker_command"):
3256
3324
if isinstance(value[k], bytes):
3257
3325
value[k] = value[k].decode("utf-8")
3258
3326
if "key_id" not in value:
3268
3336
for key, value in
3269
3337
bytes_old_client_settings.items()}
3270
3338
del bytes_old_client_settings
3271
# .host
3339
# .host and .checker_command
3272
3340
for value in old_client_settings.values():
3273
if isinstance(value["host"], bytes):
3274
value["host"] = (value["host"]
3275
.decode("utf-8"))
3341
for attribute in ("host", "checker_command"):
3342
if isinstance(value[attribute], bytes):
3343
value[attribute] = (value[attribute]
3344
.decode("utf-8"))
3276
3345
os.remove(stored_state_path)
3277
3346
except IOError as e:
3278
3347
if e.errno == errno.ENOENT:
3279
logger.warning("Could not load persistent state:"
3280
" {}".format(os.strerror(e.errno)))
3348
log.warning("Could not load persistent state:"
3349
" %s", os.strerror(e.errno))
3281
3350
else:
3282
logger.critical("Could not load persistent state:",
3283
exc_info=e)
3351
log.critical("Could not load persistent state:",
3352
exc_info=e)
3284
3353
raise
3285
3354
except EOFError as e:
3286
logger.warning("Could not load persistent state: "
3287
"EOFError:",
3288
exc_info=e)
3355
log.warning("Could not load persistent state: EOFError:",
3356
exc_info=e)
3289
3357
3290
3358
with PGPEngine() as pgp:
3291
3359
for client_name, client in clients_data.items():
3318
3386
if client["enabled"]:
3319
3387
if datetime.datetime.utcnow() >= client["expires"]:
3320
3388
if not client["last_checked_ok"]:
3321
logger.warning(
3322
"disabling client {} - Client never "
3323
"performed a successful checker".format(
3324
client_name))
3389
log.warning("disabling client %s - Client"
3390
" never performed a successful"
3391
" checker", client_name)
3325
3392
client["enabled"] = False
3326
3393
elif client["last_checker_status"] != 0:
3327
logger.warning(
3328
"disabling client {} - Client last"
3329
" checker failed with error code"
3330
" {}".format(
3331
client_name,
3332
client["last_checker_status"]))
3394
log.warning("disabling client %s - Client"
3395
" last checker failed with error"
3396
" code %s", client_name,
3397
client["last_checker_status"])
3333
3398
client["enabled"] = False
3334
3399
else:
3335
3400
client["expires"] = (
3336
3401
datetime.datetime.utcnow()
3337
3402
+ client["timeout"])
3338
logger.debug("Last checker succeeded,"
3339
" keeping {} enabled".format(
3340
client_name))
3403
log.debug("Last checker succeeded, keeping %s"
3404
" enabled", client_name)
3341
3405
try:
3342
3406
client["secret"] = pgp.decrypt(
3343
3407
client["encrypted_secret"],
3344
3408
client_settings[client_name]["secret"])
3345
3409
except PGPError:
3346
3410
# If decryption fails, we use secret from new settings
3347
logger.debug("Failed to decrypt {} old secret".format(
3348
client_name))
3411
log.debug("Failed to decrypt %s old secret",
3412
client_name)
3349
3413
client["secret"] = (client_settings[client_name]
3350
3414
["secret"])
3351
3415
3365
3429
server_settings=server_settings)
3366
3430
3367
3431
if not tcp_server.clients:
3368
logger.warning("No clients defined")
3432
log.warning("No clients defined")
3369
3433
3370
3434
if not foreground:
3371
3435
if pidfile is not None:
3374
3438
with pidfile:
3375
3439
print(pid, file=pidfile)
3376
3440
except IOError:
3377
logger.error("Could not write to file %r with PID %d",
3378
pidfilename, pid)
3441
log.error("Could not write to file %r with PID %d",
3442
pidfilename, pid)
3379
3443
del pidfile
3380
3444
del pidfilename
3381
3445
3531
3595
3532
3596
try:
3533
3597
with tempfile.NamedTemporaryFile(
3534
mode='wb',
3598
mode="wb",
3535
3599
suffix=".pickle",
3536
prefix='clients-',
3600
prefix="clients-",
3537
3601
dir=os.path.dirname(stored_state_path),
3538
3602
delete=False) as stored_state:
3539
3603
pickle.dump((clients, client_settings), stored_state,
3547
3611
except NameError:
3548
3612
pass
3549
3613
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3550
logger.warning("Could not save persistent state: {}"
3551
.format(os.strerror(e.errno)))
3614
log.warning("Could not save persistent state: %s",
3615
os.strerror(e.errno))
3552
3616
else:
3553
logger.warning("Could not save persistent state:",
3554
exc_info=e)
3617
log.warning("Could not save persistent state:",
3618
exc_info=e)
3555
3619
raise
3556
3620
3557
3621
# Delete all clients, and settings from config
3574
3638
mandos_dbus_service.client_added_signal(client)
3575
3639
# Need to initiate checking of clients
3576
3640
if client.enabled:
3577
client.init_checker()
3641
client.init_checker(randomize_start=True)
3578
3642
3579
3643
tcp_server.enable()
3580
3644
tcp_server.server_activate()
3583
3647
if zeroconf:
3584
3648
service.port = tcp_server.socket.getsockname()[1]
3585
3649
if use_ipv6:
3586
logger.info("Now listening on address %r, port %d,"
3587
" flowinfo %d, scope_id %d",
3588
*tcp_server.socket.getsockname())
3650
log.info("Now listening on address %r, port %d, flowinfo %d,"
3651
" scope_id %d", *tcp_server.socket.getsockname())
3589
3652
else: # IPv4
3590
logger.info("Now listening on address %r, port %d",
3591
*tcp_server.socket.getsockname())
3653
log.info("Now listening on address %r, port %d",
3654
*tcp_server.socket.getsockname())
3592
3655
3593
3656
# service.interface = tcp_server.socket.getsockname()[3]
3594
3657
3598
3661
try:
3599
3662
service.activate()
3600
3663
except dbus.exceptions.DBusException as error:
3601
logger.critical("D-Bus Exception", exc_info=error)
3664
log.critical("D-Bus Exception", exc_info=error)
3602
3665
cleanup()
3603
3666
sys.exit(1)
3604
3667
# End of Avahi example code
3609
3672
lambda *args, **kwargs: (tcp_server.handle_request
3610
3673
(*args[2:], **kwargs) or True))
3611
3674
3612
logger.debug("Starting main loop")
3675
log.debug("Starting main loop")
3613
3676
main_loop.run()
3614
3677
except AvahiError as error:
3615
logger.critical("Avahi Error", exc_info=error)
3678
log.critical("Avahi Error", exc_info=error)
3616
3679
cleanup()
3617
3680
sys.exit(1)
3618
3681
except KeyboardInterrupt:
3619
3682
if debug:
3620
3683
print("", file=sys.stderr)
3621
logger.debug("Server received KeyboardInterrupt")
3622
logger.debug("Server exiting")
3684
log.debug("Server received KeyboardInterrupt")
3685
log.debug("Server exiting")
3623
3686
# Must run before the D-Bus bus name gets deregistered
3624
3687
cleanup()
3625
3688
3626
3689
3627
def should_only_run_tests():
3690
def parse_test_args():
3691
# type: () -> argparse.Namespace
3628
3692
parser = argparse.ArgumentParser(add_help=False)
3629
parser.add_argument("--check", action='store_true')
3693
parser.add_argument("--check", action="store_true")
3694
parser.add_argument("--prefix", )
3630
3695
args, unknown_args = parser.parse_known_args()
3631
run_tests = args.check
3632
if run_tests:
3633
# Remove --check argument from sys.argv
3696
if args.check:
3697
# Remove test options from sys.argv
3634
3698
sys.argv[1:] = unknown_args
3635
return run_tests
3699
return args
3636
3700
3637
3701
# Add all tests from doctest strings
3638
3702
def load_tests(loader, tests, none):
3640
3704
tests.addTests(doctest.DocTestSuite())
3641
3705
return tests
3642
3706
3643
if __name__ == '__main__':
3707
if __name__ == "__main__":
3708
options = parse_test_args()
3644
3709
try:
3645
if should_only_run_tests():
3646
# Call using ./mandos --check [--verbose]
3647
unittest.main()
3710
if options.check:
3711
extra_test_prefix = options.prefix
3712
if extra_test_prefix is not None:
3713
if not (unittest.main(argv=[""], exit=False)
3714
.result.wasSuccessful()):
3715
sys.exit(1)
3716
class ExtraTestLoader(unittest.TestLoader):
3717
testMethodPrefix = extra_test_prefix
3718
# Call using ./scriptname --test [--verbose]
3719
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3720
else:
3721
unittest.main(argv=[""])
3648
3722
else:
3649
3723
main()
3650
3724
finally:
3651
3725
logging.shutdown()
3726
3727
# Local Variables:
3728
# run-tests:
3729
# (lambda (&optional extra)
3730
# (if (not (funcall run-tests-in-test-buffer default-directory
3731
# extra))
3732
# (funcall show-test-buffer-in-test-window)
3733
# (funcall remove-test-window)
3734
# (if extra (message "Extra tests run successfully!"))))
3735
# run-tests-in-test-buffer:
3736
# (lambda (dir &optional extra)
3737
# (with-current-buffer (get-buffer-create "*Test*")
3738
# (setq buffer-read-only nil
3739
# default-directory dir)
3740
# (erase-buffer)
3741
# (compilation-mode))
3742
# (let ((process-result
3743
# (let ((inhibit-read-only t))
3744
# (process-file-shell-command
3745
# (funcall get-command-line extra) nil "*Test*"))))
3746
# (and (numberp process-result)
3747
# (= process-result 0))))
3748
# get-command-line:
3749
# (lambda (&optional extra)
3750
# (let ((quoted-script
3751
# (shell-quote-argument (funcall get-script-name))))
3752
# (format
3753
# (concat "%s --check" (if extra " --prefix=atest" ""))
3754
# quoted-script)))
3755
# get-script-name:
3756
# (lambda ()
3757
# (if (fboundp 'file-local-name)
3758
# (file-local-name (buffer-file-name))
3759
# (or (file-remote-p (buffer-file-name) 'localname)
3760
# (buffer-file-name))))
3761
# remove-test-window:
3762
# (lambda ()
3763
# (let ((test-window (get-buffer-window "*Test*")))
3764
# (if test-window (delete-window test-window))))
3765
# show-test-buffer-in-test-window:
3766
# (lambda ()
3767
# (when (not (get-buffer-window-list "*Test*"))
3768
# (setq next-error-last-buffer (get-buffer "*Test*"))
3769
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3770
# (display-buffer-overriding-action
3771
# `((display-buffer-in-side-window) (side . ,side)
3772
# (window-height . fit-window-to-buffer)
3773
# (window-width . fit-window-to-buffer))))
3774
# (display-buffer "*Test*"))))
3775
# eval:
3776
# (progn
3777
# (let* ((run-extra-tests (lambda () (interactive)
3778
# (funcall run-tests t)))
3779
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3780
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3781
# (setq minor-mode-overriding-map-alist
3782
# (cons `(run-tests . ,outer-keymap)
3783
# minor-mode-overriding-map-alist)))
3784
# (add-hook 'after-save-hook run-tests 90 t))
3785
# End:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0